IN
Product
incus
47
CVEs
0
On KEV
9.9
Max CVSS
9
New 30D
Severity mix
Critical 16High 12Medium 16Low 3
Watch
Add incus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-41684 | 6.5 | May 7 | Incus: Nil Dereferences on Restore via Malformed YAML Affected: < 7.0.0 |
| CVE-2026-41647 | 6.5 | May 7 | Incus: Nil-Pointer Dereference via S3 Bucket Import Affected: < 7.0.0 |
| CVE-2026-40251 | 6.5 | May 6 | Incus out-of-bounds panic in snapshot metadata handling allows denial of service Affected: < 7.0.0 |
| CVE-2026-40197 | 6.5 | May 6 | Incus nil-pointer dereference in custom volume import allows denial of service Affected: < 7.0.0 |
| CVE-2026-40195 | 6.5 | May 6 | Incus nil-pointer dereference in storage bucket import allows denial of service Affected: < 7.0.0 |
| CVE-2026-33743 | 6.5 | Mar 26 | Incus vulnerable to denial of source through crafted bucket backup file Affected: < 6.23.0 |
| CVE-2026-115373 New | 6.3 | Oct 22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid} Affected: before 6.0.7; 6.1.0 before 7.0.2; 7.1.0 before 7.5.0 |
| CVE-2026-115378 New | 5.8 | Oct 22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull Affected: before 6.0.7; 6.1.0 before 7.0.2; 7.1.0 before 7.5.0 |
| CVE-2026-41648 | 5.0 | May 7 | Incus: Unbounded YAML Metadata Decode via Parsing Affected: < 7.0.0 |
| CVE-2026-35527 | 5.0 | May 5 | Incus blind SSRF via image import preflight HEAD request Affected: < 7.0.0 |
| CVE-2026-40243 | 4.8 | May 6 | Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation Affected: < 7.0.0 |
| CVE-2026-33542 | 4.8 | Mar 26 | Incus does not verify combined fingerprint when downloading images from simplestreams servers Affected: < 6.23.0 |
| CVE-2026-47753 | 4.4 | Aug 21 | Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) Affected: < 7.1.0 |
| CVE-2026-115370 New | 4.3 | Oct 22 | Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh Affected: 6.0.5 before 6.0.7; 6.12.0 before 7.0.2; 7.1.0 before 7.5.0 |
| CVE-2026-62313 | 4.3 | Aug 21 | Incus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated` Affected: < 7.3.0 |
| CVE-2026-41685 | 4.3 | May 7 | Incus: Unbounded binary import disk exhaustion Affected: < 7.0.0 |
Showing 16
